CVE-2025-8830
Published: 11 August 2025
Summary
CVE-2025-8830 is a low-severity Command Injection (CWE-77) vulnerability in Linksys Re6250 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
A vulnerability has been identified in multiple Linksys wireless range extender models including the RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 up to firmware version 20250801. The issue resides in the function sub_3517C within the /goform/setWan endpoint, where improper handling of the Hostname argument permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 2.1.
An authenticated remote attacker can supply a crafted Hostname value to the affected endpoint and execute arbitrary operating system commands on the device. The attack requires network access and valid low-privileged credentials but no user interaction. A proof-of-concept exploit has been published publicly, enabling potential use by threat actors.
No vendor patch or official advisory has been issued; the manufacturer was notified prior to disclosure but did not respond. The available references consist of a public GitHub repository containing the vulnerability details and proof-of-concept along with VulDB entries that document the finding.
The EPSS score remains flat at 0.0415 with no material increase since publication, indicating limited observed exploitation interest to date despite the public availability of exploit code.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24123
Vulnerability details
A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of the file /goform/setWan. The manipulation of the argument Hostname leads to os command injection.…
more
The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The OS command injection vulnerability in the web interface (/goform/setWan Hostname parameter) on public-facing Linksys range extenders enables exploitation of a public-facing application (T1190) and indirect command execution (T1202) remotely.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all inputs (including the Hostname argument to /goform/setWan) to block command metacharacters before they reach the OS.
Limits the privileges of authenticated web-interface accounts so that even a successful command injection yields only minimal impact on the device.
Mandates prompt application of vendor patches or workarounds once the OS command-injection flaw in sub_3517C is known.